Software Container Layer Measurement for Efficient Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for measuring the integrity of software containers are inefficient in terms of processing and memory resources, particularly when multiple containers share base and intermediate layers, leading to unnecessary hash processing.
Innovation Solution
Implementing a layer-oriented integrity measurement approach using an agent that calculates hashes for individual files or groups of files within the container image and overlay file system, along with metadata measurements, and logs these in a secure memory for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional integrity measurement methods are used for software containers, then complete integrity verification is achieved, but processing efficiency deteriorates and memory resources are wasted due to unnecessary hash processing of shared layers
Solution Approach 1:
The patent segments the container file system into distinct layers (read-only base layers and read-write overlay layers). Instead of hashing the entire file system, the measurement agent selectively hashes only the overlay layers that contain modified files. This segmentation allows efficient integrity verification by processing only the necessary portions while skipping identical shared layers that are already measured and stored in the image database.
2Reliability
If traditional integrity measurement methods are used for software containers, then complete integrity verification is achieved, but memory usage increases due to redundant hash storage
Solution Approach 1:
The patent merges the measurement of overlay layers with the existing base layer measurements stored in the image database. Instead of storing separate measurements for entire container images, the system stores only the differential overlay layer measurements. The complete integrity verification is achieved by combining the stored base layer hashes with the newly computed overlay layer hashes, significantly reducing memory usage while maintaining verification completeness.
3Productivity
If layer-oriented measurement is implemented, then processing efficiency is improved by avoiding redundant hash calculations, but measurement complexity increases
Solution Approach 1:
The patent implements a dynamic measurement approach where the measurement agent adapts its behavior based on the container state. It dynamically identifies which layers are read-only (skipping hashing) versus which layers have modifications (requiring hashing). The system dynamically queries the container file system structure, determines the overlay layer boundaries, and selectively processes only the necessary layers. This dynamic adaptation simplifies the overall process compared to static full-image hashing while maintaining security.
Data Source
AI summary
A process includes, in a computer system, acquiring a first measurement that corresponds to a software container. Acquiring the measurement includes a hardware processor of the computer system measuring a given layer of a plurality of layers of layered file system structure corresponding to the software container. The given layer includes a plurality of files, and the first measurement includes a measurement of the plurality of files. The process includes storing the first measurement in a secure memory of the computer system. A content of the secure memory is used to verify an integrity of the software container.